__ACCESSTOKEN__ is not private about bad-ass-salesforce-stack

[ChuckJonas]

The access token is required to call the REST API from the client-side.

You could possibly wrap this in an Apex Controller method, but that would only maybe serve to "hide" the underlying implementation from the security review. At the end of the day, if Salesforce says you're not allowed to use client side API access in AppExchange packages, then you need to come up with some other way to communicate with Salesforce.

In that case your option are:

• Embed JSON data into the window scope using the Apex Controller method
• Use the AJAX Remote Callout instead of the rest API. How to make these calls with ts-force.

Also... I'm by no means an expert in AppExchange package development, but my understanding was that Salesforce wouldn't pass anything other than their "officially supported" framework (LWC)